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WE CLAIM: 

1. Apparatus for processing data, said apparatus comprising: 

a processor operable in a plurality of modes and a plurality of domains, said 
plurality of domains comprising a secure domain and a non-secure domain, said 
plurality of modes including: 

at least one secure mode being a mode in said secure domain; and 

at least one non-secure mode being a mode in said non-secure domain; 

wherein 

when said processor is executing a program in a secure mode said program has 
access to secure data which is not accessible when said processor is operating in a 
non-secure mode; 

said processor is responsive to one or more exception conditions for triggering 
exception processing; and 

said processor being responsive to one or more parameters specifying which of 
said exceptions should be handled by a secure mode exception handler executing in a 
secure mode and which of said exceptions should be handled by an exception handler 
executing in a mode within a current one of said secure domain and said non-secure 
domain when that exception occurs. 

2. Apparatus as claimed in claim 1, wherein at least one of said parameters is 
stored in an exception trap mask register. 

3. Apparatus as claimed in claim 2, wherein said exception trap mask register is 
writable when said processor is in a secure mode and said exception trap mask 
register is non-writable when said processor is in a non-secure mode. 

4. Apparatus as claimed in claim 2, further comprising a configuration 
controlling coprocessor associated with said processor and wherein said exception 
trap mask register is a register within said configuration controlling coprocessor. 

5. Apparatus as claimed in claim 1, wherein at least one of said parameters is a 
signal value provided at a hardware input to said processor. 
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6. Apparatus as claimed in claim 1, wherein said secure exception handler is part 
of a secure operating system operable in said secure mode. 

5 7. Apparatus as claimed in claim 1, wherein said non-secure exception handler is 
part of a non-secure operating system operable in said non-secure mode. 

8. Apparatus as claimed in claim 1, wherein said processor is also operable in a 
monitor mode and any switching between a secure mode and a non-secure mode 
10 required for handling of an exception as specified by said parameters takes place via 
said monitor mode, said processor being operable at least partially in said monitor 
mode to execute a monitor program to manage switching between said secure mode 
and said non-secure mode. 

15 9. Apparatus as claimed in claim 8, wherein said monitor program may change 
said parameters to determine where an exception should be handled. 

10. Apparatus as claimed in claim 8, wherein said processor includes a register 
bank and said monitor program is operable to flush at least a portion of said register 
20 bank shared between said secure mode and said non-secure mode when switching 
from said secure mode to said non-secure mode such that no secure data held within 
said register bank may pass from said secure mode to said non-secure mode other than 
as permitted by said monitor program. 

25 11. A method of processing data, said method comprising the steps of: 

executing a program with a processor operable in a plurality of modes and a 
plurality of domains, said plurahty of domains comprising a secure domain or a non- 
secure domain, said plurality of modes including: 

at least one secure mode being a mode in said secure domain; and 
30 at least one non-secure mode being a mode in said non-secure domain; 

wherein 

when said processor is executing a program in a secure mode said program has 
access to secure data which is not accessible when said processor is operating in a 
non-secure mode; 
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in response to one or more exception conditions triggering exception 
processing using an exception handler; wherein 

said processor selects an exception handler in response to one or more 
parameters specifying which of said exceptions should be handled by a secure mode 
5 exception handler" executing in a secure mode and which of said exceptions should be 
handled by an exception handler executing in a mode within a current one of said 
secure domain and said non-secure domain when that exception occurs. 

12. A method as claimed in claim 11, wherein at least one of said parameters is 
10 stored in an exception trap mask register. 

13. A method as claimed in claim 12, wherein said exception trap mask register is 
writable when said processor is in a secure mode and said exception trap mask 
register is non-writable when said processor is in a non-secure mode. 

15 

14. A method as claimed in claim 12, further comprising a configuration 
controlling coprocessor associated with said processor and wherein said exception 
trap mask register is a register within said configuration controlling coprocessor. 

20 15. A method as claimed in claim 11, wherein at least one of said parameters is a 
signal value provided at a hardware input to said processor. 

16. A method as claimed in claim 11, wherein said secure exception handler is 
part of a secure operating system operable in said secure mode. 

25 

17. A method as claimed in claim 11, wherein said non-secure exception handler 
is part of a non-secure operating system operable in said non-secure mode. 

18. A method as claimed in claim 11, wherein said processor is also operable in a 
30 monitor mode and any switching between a secure mode and a non-secure mode 

required for handling of an exception as specified by said parameters takes place via 
said monitor mode, said processor being operable at least partially in said monitor 
mode to execute a monitor program to manage switching between said secure mode 
and said non-secure mode. 
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19. A method as claimed in claim 18, wherein said monitor program may change 
said parameters to determine where an exception should be handled. 

5 20. A method as claimed in claim 18, wherein said processor includes a register 
bank and said monitor program is operable to flush at least a portion of said register 
bank shared between said secure mode and said non-secure mode when switching 
from said secure mode to said non-secure mode such that no secure data held within 
said register bank may pass from said secure mode to said non-secure mode other than 

10 as permitted by said monitor program. 

21. A computer program product having a computer program operable to control a 
data processing apparatus in accordance with the method of claim 1 1 . 
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